Edit: Downvotes, really? :/
Edit: Downvotes, really? :/
Can you elaborate?
This needs some explanation.
Also, what's stopping them from just lying?
Well, hopefully the prospect of fines if they're caught. I'm hoping that the local data authorities won't be lenient if a company is caught outright lying.
For that reason, GDPR will always draw some ire from me.
If you don’t understand how “ambiguous threat of a fine” isn’t calmed by “it hasn’t happened yet,” I can’t help you. What if my site was politically controversial? Should I trust all EU governments to act responsibly and not take advantage of their power ever?
So I wouldn’t say americans are particularly more bothered by it. But why shouldn’t we be? I have no representation in EU law.
Not if your criticisms are entirely unfounded and bordering on paranoia, no.
> But why shouldn't we be? I have no representation in EU law.
What? Do you think only EU citizens have rights in the EU?
I am not a lawyer and I do not have access to a lawyer. I can't afford it. Therefore, I have to assume that I simply do not have the expertise to understand GDPR fully. And unlike most laws, it is not a matter of "do things right and nothing will happen", and it has very vicious teeth on top of that.
So from my PoV, the risk profile of GDPR is HUGE. If I'm running some pre-existing software stack written in the early 2000s, it simply doesn't have the necessary data provenance tracking that is needed to be GDPR compliant.
For what it's worth, I make no money from things I run, not even on ads. Zilch. However, I've spent at least hours processing GDPR requests, and I have absolutely no idea if they are being done correctly, because I'm not a lawyer, and I do not have access to a lawyer.
> What? Do you think only EU citizens have rights in the EU?
I'm talking about representation in the sense of a democracy. I am part of the system in the U.S. - I can vote. I have no representation when it comes to laws made in the EU. The reverse applies too, but as far as I know there's nothing quite as scary as GDPR from the U.S. side.
At the same time, I'll happily give you any data I have about you. I don't really collect anything. Your IP address gets logged and you give me an email address if you want to get a newsletter (on most sites of mine). I'll even happily delete your data, such as it is.
I'm in the camp that says if I have your data I have to secure it. So, I'd rather not really collect more than I need. I don't even need to know your real name and you're more than welcome to use a fake email address for many things.
But, no... No, I'm not going to nag my viewers with a cookie notice. I don't care if they come from the EU. I don't like the nag and I'm not going to nag you.
By not being paranoid.
Not "a big company was fined an amount of money that would be life destroying if I had to pay it for a personal project", because revenue/economic means are a key factor in GDPR fine calculation.
.... hiring an actual Data Protection Officer is only required by the GDPR if you meet one of three criteria:
* Public authority — The processing of personal data is done by a public body or public authorities, with exemptions granted to courts and other independent judicial authorities.
* Large scale, regular monitoring — The processing of personal data is the core activity of an organization who regularly and systematically observes its “data subjects” (which, under the GDPR, means citizens or residents of the EU) on a large scale.
* Large-scale special data categories — The processing of specific “special” data categories (as defined by the GDPR) is part of an organization’s core activity and is done on a large scale.
https://gdpr.eu/data-protection-officer/If you are a small operator who messes up AND you are in the EU and you ignore strongly worded letters of warning with instructions on what you need to do to comply then you MIGHT be fined/penalized.
If you are not making money in the EU than you are seriously unlikely to even be noticed messing up.
If you miss-configured the logs on your blog or small non-EU business and kept user ids and IP addresses AND are outside the EU no one will bother you.
If a privacy conscious EU citizen contacts you to close an account they made with you or delete your data you have many weeks (90 days i think ultimately) to respond, negotiate and do your best to get it done (and provide them whatever data you may have collected on them)
If you have any of a dozen legitimate reasons to have personal data and you clearly explained this to the EU citizens you collected data from you are not going to hear from anyone. e.g. a EU company I work with has extensive logs of their employees changes and updates to data (imagine git commit messages). These are required logs for the business, an ex-employee cannot ask you delete that history under GDPR. Same for their b2b customers. The existence of these logs are made clear up front. It's a regulated requirement that they exist etc.
If you decided to sell the log data to a third party as part of some profile of the citizen and you didnt say you intended to do that then you ABSOLUTELY would hear from someone. But I would think you very much should and this is the point.
Same principles apply for California Consumer Privacy Act (CCPA) in the US.
Do you have more than 250 employees? Are you a public authority or body? Are you performing activities that "require regular and systematic monitoring of data subjects on a large scale"? Is your core activity processing on a large scale of special categories of data pursuant to Article 9 or personal data relating to criminal convictions and offences?
No? Then no need to have a data protection officer or data protection impact assessment.
You still need to implement appropriate safety measures and efforts to follow GDPR, where "appropriate" takes the scope of your processing into account. https://gdpr-info.eu/art-24-gdpr/, need a legitimate reason for using the data, etc., but all of this is very doable, and you're probably already in compliance if you care the smallest bit about your user's privacy and follow normal best practices like rotating your logs.
IIUC (there are two directives and I'm less familiar with the other one) you don't even need a cookie dialog as long as you aren't setting any unnecessary cookies.
The most recent examples of individuals being fined have been fines around €200 [0]
[0] https://gdprhub.eu/index.php?title=ANSPDCP_(Romania)_-_Fine_...
I.e the maximum fine is highly unlikely for anyone to get, and if you get it you have done some very bad things.
And not only that, my concerns and dissent regarding GDPR piss people off so much, that at this point, every comment I post just gets downvoted immediately. Now I realize it’s against HN guidelines to discuss this, but when I post a comment and the delay it takes for me to return from the post page is enough for my comment to already have a downvote, I feel discouraged. It’s very clear the person who did that had no good faith intent on a discussion nor intent to even minimally read my comment. And I’m supposed to try to argue my points in good faith despite this.
The pro-GDPR crowd may be winning the mindshare but they are inheriting the cancer of something not allowed to be criticized. And if we ever do see an egregious fee driven by political motivations, am I supposed to feel smug for having predicted the possibility or sad that my mere expression that the default maximum fines are so ridiculous that they basically terrorize anyone who is not a multinational corporation turned out to be well-founded?
All I ever asked for was for people to recognize the chilling effects that this regulation can have. The internet used to have so many small websites, forums and wikis, and many of these fall under the umbrella of GDPR. And this is basically the treatment I get for trying to represent this dying breed of website: as some corporate shill worth being buried and not considered.
It’s not like I care that much about being with the mob, but it pains me that as the open internet gradually dies, people flat out just don’t care. GDPR as it is today is just represents a huge amount of risk for anyone that is not a multinational corporation, and it only gets scarier the further down you are. I’m sorry but just telling people to not worry about how the law is written will not work. Some people will ignore it, some people will try to follow it, and some people will just stop trying altogether deciding the risk simply isn’t worth it. And that latter part is most likely to occur for websites that are more objectionable, since they will likely face harsher treatment just due to cognitive biases alone, since we’re talking about considerations that humans make rather than the word of law.
And for me as a user, it sucks if your side project leaks my credit card and SSN, because I'll be dealing with the identity theft and fraud. If you're not competent enough to keep them safe, then use a vendor that is or don't process then at all.
And as well, GDPR, again, doesn’t guarantee the safety of your data. It just adds fines to some circumstances where your data is misused. But an honest breach doesn’t lead to fines as far as I can tell, so you just have to live with that possibility either way.
As best as I can tell, there is no legally binding texts anywhere that limits the fines. The maximums start at €20 million and go higher if you’re huge. In the mindset of “hope is not a strategy,” this maximum fine being the only legally binding limit is enough to make you go home. Maybe small companies can hope for preferential treatment, but as an individual even small fees could do serious harm.
Escape to Mexico in the worst scenario.
South America is anyway becoming more and more appealing the more the West progress.
That said, not that it changes much but I stopped taking EU customers (I take businesses and not customers) because of vatmoss and gdpr.
It is a bit ironic that it's probably a good idea for an EU service to not serve EU customers.